19ecfed64313a2f9addbd5fb71fef2150492a7b073bd97d807d6e4f549576f7f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82370dcc207c67f7012a875e5533371c_JaffaCakes118.html
Size

27KB
MD5

82370dcc207c67f7012a875e5533371c
SHA1

6f5d3239bc0f3819ffb64cadc9b1488499881e8a
SHA256

19ecfed64313a2f9addbd5fb71fef2150492a7b073bd97d807d6e4f549576f7f
SHA512

3baa9fe9c6f351fe095ec601a86382887fcdf32c155129ca2d78d5b1c7fa0b33caa16223ae167e5289c78edbc5682f63f473d38278e623b6d6a610fb4f8f0f12
SSDEEP

192:uwb8b5nl6nQjxn5Q/UnQiePNnrnQOkEntk2nQTbntnQ9enrm60/BDQl7MBvqnYnq:sQ/La9UBaS1+lU0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423184688"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C45FF11-1E0D-11EF-8414-4A4F109F65B0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3012	3008	iexplore.exe	28
PID 3008 wrote to memory of 3012	3008	iexplore.exe	28
PID 3008 wrote to memory of 3012	3008	iexplore.exe	28
PID 3008 wrote to memory of 3012	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82370dcc207c67f7012a875e5533371c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0dc73d57e311fec5b70e7e21693a0b6

SHA1
d2d5fb089e93cd1f889d0967c91b4566f495294f

SHA256
82d3eadf3bd1f5f58cf1d01451eed72190485ad6eb06fdf7b9688553317bc641

SHA512
6364631a37ca88e00ca548c94bf55c75d89c946c1ed03f103f5191122adce4f3696e32a744df7bac6046cdee690095db79d9be146a6acd8a4a784723e954820b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee376fd2b5f2860c07168e175c5503e0

SHA1
9a5f6a419c7dd4f5a398e616173a5af59e9af7f7

SHA256
750a7240e048ec0001dd30a4226cdebf2f5e49adf53541cdc420d8f8aa2b5eb9

SHA512
043a6ef1013003cf57d07b9240f9f36ab7f31a256bc243e284c7a93bcd28665d9b0a3e6a4eff0f85555db3ed600785046b9fbf0f3c5655972ccb2c725271b38d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2df1fe73cb4edd26391db6aaa30383b5

SHA1
d89c55fb8eb6d9903ae5702048c4793ca71a6447

SHA256
9f5faab9a5c8c382337d931b23e34d6c5afdd69940d381f247dec7a353858213

SHA512
eb90c30af2ea54bd11fffa0ae5d99043f33bd5f100c05a5463d5a172055f5993d76738109fa8fd17fec96e35f639dc75cb4b599f0332ee30a6e048601a584a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3659f9a993690273176affa51e815460

SHA1
25cab3c2ae23fb9779aaf2375853b0ef3bd0c51f

SHA256
630890288b721a2ff014f150ce16ee69c400e0cc2e446637fc623c27678cce70

SHA512
84196c982fb82a0d67b62ee89469f3868162a156a0ca9ce71fc9ae010e6cbe48be0a5f4ef70148db2e1f64e1958abcd7c282a1695eec3ff19332011bc7268186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bc2bda27df11d57ba109a302efe7785

SHA1
3634ed96f4e2fcd3b290abc9fb49bcb65ee016c3

SHA256
38365dccd47852203c5facb222a32da13e048e9872c6f482d1d7cae72a33786c

SHA512
048920fae973dbf09036bdd8b7c29f7044c16b6a5c5edd6bddd9b4a6b2bb87c3f2e47bb2aed3fc77609d0c1a85cff7129409e7bbdf84d80fa0014f60046df10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be3cb1a1d6130b20a2e293badbf41fb3

SHA1
5a668603b543fd5c0d3f53ca0f1febc35ebbb597

SHA256
736c573fa55756232bde830cb091c4abe998e695e511d017e630b426f6fb7684

SHA512
047251a3f5a6912821c1c3ad4c97c65e6c9af16f6563034573693c6fd1736c88cda42b71ef30724f54fa7e796482b296b10c5f6c941f6151620f75d101fff910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9e109f01e7ecced163871b71b075aa1

SHA1
24ddde9efb18e1729450184708f3d813bdf48c2e

SHA256
8767f8c94a5d76c7b07afe9902730fcbf7fa752197a73f79e00e9d4b9746e838

SHA512
9c756d7af9aaeb38cc3951af288c34a9e596b26aa6746a6d4995224d5cb2d48101b9e91aef396e78e8fef8a4f7bb2fea2f5bc7e492348ae2af5047e5b7ce8d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
847dd7287974b21f26756e4129d8ec7f

SHA1
733751cd391f6f6f553038292df8c9f176be6bd5

SHA256
710713a0288000d36bfa92e022017de84df115cf2fc40be65cb9a7c26968d1f4

SHA512
de580b34e10cc570eb6dfecfccc38c4b6935af656af074aff782086f5f189c85b224a1423b80e0522c020bc03b29d3cb2bdbcea0f9cd0101a2fe0ad5f58db2b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d4427f98bac53b595da1c33dd2dafca

SHA1
cddc612762a004dcc8adee540ed80f8b211b1f79

SHA256
ab7754759f8406567bd079761d17221bd6e0febaff8aa5716ad514825ee6c249

SHA512
69c634acb26be9c75a16d33576da72e476855bea4da2b6feb7236b64f3ba3e0a9abec8b7322d074e9dce5e8d317a0c5706e55bb4f876c28fe4296ed2265e41ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab211A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar220B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit